fix(quiesce): is_terminal_anchor misses the refinery-handoff window — burns polecat sessions after PR #205 (tk-yxlqb)#215
Open
zook-bot wants to merge 1 commit into
Open
fix(quiesce): is_terminal_anchor misses the refinery-handoff window — burns polecat sessions after PR #205 (tk-yxlqb)#215zook-bot wants to merge 1 commit into
zook-bot wants to merge 1 commit into
Conversation
is_terminal_anchor() recognized a completed mol-polecat-work molecule by
anchor status=closed or merge_result in {pre_open_gate, pull_request,
merged}. All three merge_result values are stamped BY THE REFINERY, which
runs a beat behind the polecat's own hand-off, so the predicate misses the
window in between. During it the anchor reads
status=open merge_result=<absent> assignee=<rig>/<prefix>refinery
which the pass reads as "still live" while the molecule is already dead —
so its never-closed load-context step stays open + ready + routed, the
pool's exact offer predicate, and keeps burning polecats. This is an
additional shape, not a regression of PR #205 (tk-p9ji9), which is correct
as far as it goes.
Observed by the witness patrol on tk-2l13a: the window ran ~08:10Z-08:27Z
(~17 min) and consumed two polecat sessions, each re-deriving "already
done" before escalating. The window is not self-healing — a periodic pass
that happens to run mid-window leaves the husk armed until the next cycle.
Adds the anchor's assignee as a fourth terminal predicate, per the
witness's recommendation on tk-p9ji9: an anchor handed to the refinery is
by definition past polecat work, stamped or not. Matching is on the final
dotted component after dropping the optional `<rig>/` qualifier
(`refinery` or `*.refinery`), deliberately anchored rather than a loose
`*refinery*` substring — every assignee shape in this rig's history is
`<rig>/gc-toolkit.refinery`, `<rig>/gastown.refinery`, or
`gascity/gc-toolkit.refinery`, and a false positive here would quiesce a
LIVE molecule and drain the polecat working it. That fail-closed bias is
why the anchor read now also skips on an empty status: every real bead has
one, so an empty status means the read failed, not that the anchor has no
status. The prior `[ "$ainfo" = "|" ]` guard could not survive a third
field anyway. The per-root log line now reports the assignee it inspected,
so the patrol log says which predicate fired.
Not addressed here, deliberately: the witness also noted that a molecule's
ROOT bead can keep `gc.routed_to` while its steps are clean, and the root
is what pool scale_check counts. That is a separate selection-scope gap
(this pass only sweeps beads carrying `gc.step_ref`), not part of the
terminal predicate, and is filed separately rather than folded in here.
Validation:
- Hermetic test gains (HANDOFF): an open + unstamped + refinery-assigned
anchor is terminal. The (LIVE) fixture is now the SAME shape but
assigned to a polecat, pinning the discrimination — a loose "the anchor
has an assignee" predicate would pass there and drain a working polecat.
- Mutation check: reverting only the new case arm fails exactly the 3
handoff assertions and leaves the other 20 green.
- 13/13 script suites green; shellcheck clean on the script (the test
file's SC2015 notes are its established `A && ok || bad` idiom).
- Live --dry-run against the rig: 2 husks (anchors tk-fvqn0, tk-9l9ka),
12 steps, that today's deployed pass structurally cannot see. Between
two consecutive dry-runs the live patrol quiesced 6 other steps and left
exactly those 12 behind. Both still-live molecules — including this
session's own — were correctly left alone.
Contributor
Author
|
Codex signoff (pre-open, comment-only — not an approval): COMMENT signoff for pre-open branch review. Reviewed branch: polecat/tk-yxlqb -> main Checks run:
Shellcheck was not available in this environment ( |
johnzook
reviewed
Jul 22, 2026
johnzook
left a comment
johnzook
left a comment
Contributor
There was a problem hiding this comment.
I'm skeptical of this entire script... If witness is having to do constant manual work, that's probably not an upstream design, so we're doing something wrong.
johnzook
previously approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The fix that landed in PR #205 (tk-p9ji9, merged) is correct but INCOMPLETE.
This is an additional case, not a regression.
is_terminal_anchor() in assets/scripts/quiesce-completed-workflows.sh treats an
anchor as terminal when status=closed OR merge_result is one of
{pre_open_gate, pull_request, merged}.
It MISSES the handoff window between "polecat pushed and handed off to the
refinery" and "refinery stamps merge_result". In that window the anchor reads:
so the molecule is not recognized as terminal and its never-closed steps keep
being re-offered to the pool.
EVIDENCE (gc-toolkit witness patrol, 2026-07-22, lx-wisp-61qyk):
tk-2l13a sat in exactly that state from ~08:10Z to ~08:27Z (~17 min) and burned
TWO polecat sessions (slit/lx-vg082, rictus/lx-1uko6) re-deriving "already done"
before escalating. Both were drained immediately after.
SUGGESTED FIX
Add "anchor assignee == the rig refinery" as a fourth terminal predicate. That
closes the window precisely: an anchor assigned to the refinery is by definition
past polecat work, whether or not merge_result has been stamped yet.
Full detail is in two comments the witness left on tk-p9ji9.
Implementation notes
Implemented: is_terminal_anchor() now treats an anchor assigned to the rig refinery as terminal, closing the refinery-handoff window (open + unstamped merge_result + assignee=/refinery) that re-offered dead load-context steps to the pool. Matches refinery|*.refinery on the assignee's final dotted component. Anchor read gained the assignee field + fail-closed on empty status. Hermetic test gains HANDOFF case; LIVE fixture reshaped to a polecat-assigned same-shape anchor to pin the discrimination. 13/13 suites green, shellcheck clean, mutation-verified. Root-scope follow-up filed as tk-i3fb7.
Refinery handoff
tk-yxlqb(bug, P1)polecat/tk-yxlqbmain3db87ed4; PR opened codex-green.